Security Basics mailing list archives

RE: Possible worm infection or something else?


From: "Fraser Morris" <frasermorris74 () hotmail com>
Date: Tue, 09 Dec 2003 18:33:41 +0000

Just reviewed my previous post, my apologies I forgot to post a link for the strain I found:
http://www.sophos.com/virusinfo/analyses/w32agobott.html
It runs as a service, look in the registry for key 'cfgldr' and a file in system32 called scvhost.exe.

Fraser

_________________________________________________________________
Tired of 56k? Get a FREE BT Broadband connection http://www.msn.co.uk/specials/btbroadband


---------------------------------------------------------------------------
----------------------------------------------------------------------------


Current thread: